MITRE ATT&CK technique

Trusted Developer Utilities Proxy Execution detection rulesT1127

Trusted Developer Utilities Proxy Execution (T1127) is a MITRE ATT&CK technique in the Execution tactic. This page lists the 21 community-maintained Sigma detection rules in the library mapped to T1127 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.

T1127 on attack.mitre.org21 rules

Tactic

Execution

Kavremover Dropped Binary LOLBIN Usage
high
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.
windows · process_creation
Potential Arbitrary Code Execution Via Node.EXE
high
Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc
windows · process_creation
Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
high
Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.
windows · process_creation
Remote Thread Creation Ttdinject.exe Proxy
high
Detects a remote thread creation of Ttdinject.exe used as proxy
windows · create_remote_thread
Silenttrinity Stager Msbuild Activity
high
Detects a possible remote connections to Silenttrinity c2
windows · network_connection
Suspicious Child Process of AspNetCompiler
high
Detects potentially suspicious child processes of "aspnet_compiler.exe".
windows · process_creation
Suspicious File Created by ArcSOC.exe
high
Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates a file with suspicious file type, indicating that it may be an executable, script file, or otherwise unusual.
windows · file_event
Suspicious Use of CSharp Interactive Console
high
Detects the execution of CSharp interactive console by PowerShell
windows · process_creation
AspNetCompiler Execution
medium
Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.
windows · process_creation
C# IL Code Compilation Via Ilasm.EXE
medium
Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.
windows · process_creation
Detection of PowerShell Execution via Sqlps.exe
medium
This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
windows · process_creation
Microsoft Workflow Compiler Execution
medium
Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.
windows · process_creation
Node Process Executions
medium
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
windows · process_creation
Potential Binary Proxy Execution Via Cdb.EXE
medium
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
windows · process_creation
Potential Mftrace.EXE Abuse
medium
Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.
windows · process_creation
SQL Client Tools PowerShell Session Detection
medium
This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
windows · process_creation
Use of Remote.exe
medium
Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.
windows · process_creation
Use of TTDInject.exe
medium
Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)
windows · process_creation
Use of VSIISExeLauncher.exe
medium
The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries
windows · process_creation
Use of Wfc.exe
medium
The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.
windows · process_creation
JScript Compiler Execution
low
Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
windows · process_creation

Top products

Tactic

Kavremover Dropped Binary LOLBIN Usage

Potential Arbitrary Code Execution Via Node.EXE

Potentially Suspicious ASP.NET Compilation Via AspNetCompiler

Remote Thread Creation Ttdinject.exe Proxy

Silenttrinity Stager Msbuild Activity

Suspicious Child Process of AspNetCompiler

Suspicious File Created by ArcSOC.exe

Suspicious Use of CSharp Interactive Console

AspNetCompiler Execution

C# IL Code Compilation Via Ilasm.EXE

Detection of PowerShell Execution via Sqlps.exe

Microsoft Workflow Compiler Execution

Node Process Executions

Potential Binary Proxy Execution Via Cdb.EXE

Potential Mftrace.EXE Abuse

SQL Client Tools PowerShell Session Detection

Use of Remote.exe

Use of TTDInject.exe

Use of VSIISExeLauncher.exe

Use of Wfc.exe

JScript Compiler Execution